Nginx下配置Https证书

r囧r小猫 2022-10-16 09:54 213阅读 0赞

# 1、前提 #

1、安装依赖

> yum -y install pcre-devel openssl openssl-devel

2、Nginx安装http\_ssl\_module模块

检查是否支持

> ./nginx -V

nginx version: nginx/1.20.1
    built by gcc 9.3.1 20200408 (Red Hat 9.3.1-2) (GCC) 
    built with OpenSSL 1.0.2k-fips  26 Jan 2017
    TLS SNI support enabled
    configure arguments: --prefix=/opt/software/nginx --with-http_ssl_module --with-http_stub_status_module --with-http_image_filter_module=dynamic

如果nginx缺少http\_ssl\_module模块，编译安装的时候带上--with-http\_ssl\_module配置

> ./configure --prefix=/opt/soft/nginx --with-http\_stub\_status\_module --with-http\_ssl\_modul
> 
> make

# 2、配置 #

1、证书和公钥存放在指定位置

2、nginx配置，监听443端口

server {
    	listen    443 ssl;
    	server_name  mp.com.cn;
    	
    	if ($host != 'mp.com.cn'){
    	   return 403;
    	}
    	#证书
    	ssl_certificate      /opt/software/nginx/ssl/full_chain.pem;
    	#私钥
    	ssl_certificate_key  /opt/software/nginx/ssl/private.key;
    	#session缓存的类型和大小
    	ssl_session_cache    shared:SSL:1m;
    	#session缓存超时时间
    	ssl_session_timeout  5m;
    	
    	ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;
    	ssl_protocols TLSv1.2;
    	add_header Strict-Transport-Security "max-age=31536000";        
       
    	ssl_prefer_server_ciphers  on;
     
    	add_header X-Frame-Options SAMEORIGIN;
    	#add_header Content-Security-Policy "default-src 'self' mp.com.cn res.wx.qq.com open.work.weixin.qq.com  'unsafe-inline' 'unsafe-eval' blob: data: ;";
    	add_header X-Xss-Protection "1;mode=block";
    	add_header X-Content-Type-Options nosniff;
    
        location / {
            root   html;
            index  index.html index.htm;
        }
    
    }

4、重新加载nginx

先检查

> ./nginx -t

重新加载 ，然后OK

> ./nginx -s reload